Figure 15: User In Domain "Global" With A Predefined Role - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Copyright © 2010, Juniper Networks, Inc.
is one of the options listed above.
predefined-role-name
For example, if a user is in domain d1 with a role of IDP Administrator, the domain name
is global.d1 and the role is global.d1:IDP Administrator.
Creating Roles
If a user is defined in the local database or defined in a RADIUS server, NSM uses a role
mapping list from the local database. The custom roles must be created in NSM. If the
custom role belongs to a subdomain, it must be created in that subdomain. If the role is
created in the global domain, it is automatically inherited into the subdomain and can
be assigned to a subdomain user.
NOTE: A role defined in a subdomain belongs only to that subdomain.
Assigning Roles
If a user is defined in the local database, NSM uses a role mapping list from the local
database. Otherwise, the RADIUS administrator must configure the role mapping list for
each user on the RADIUS server.
Figure 15 on page 71 through Figure 21 on page 74 show examples of assigning predefined
and custom roles through RADIUS. All examples assume that the user will be
authenticated and authorized using a RADIUS server.

Figure 15: User in Domain "global" with a Predefined Role

Chapter 3: Configuring Role-Based Administration
71